CVE-2026-64560: Use-After-Free in Linux posix-cpu-timers
CVE-2026-64560 details a Linux kernel posix-cpu-timers use-after-free caused by an exec() race condition, along with its memory-ordering fix.
A use-after-free vulnerability was identified in the Linux kernel's posix-cpu-timers subsystem, triggered by a race condition during non-leader exec(). When sys_timer_delete() deletes a timer while a non-leader thread simultaneously calls exec() and switches the thread-group leader, the old leader's sighand structure can be freed while the timer object is still accessed, particularly for TGID-targeted, queued timers inherited across exec().
The bug also affects posix_cpu_timer_set() and posix_cpu_timer_rearm(): the former can transiently return -ESRCH to userspace but shares the same UAF risk in do_cpu_nanosleep() where the timer object lives on the stack, while the latter can silently fail to rearm a timer, causing it to stop expiring. On weakly-ordered architectures, missing memory barriers could also produce false-positive WARN() triggers during debugging.
The fix introduces smp_store_release() in __exit_signal(), adds smp_acquire__after_ctrl_dep() to lock_task_sighand(), and creates a new helper that safely retries task lookup and sighand locking instead of failing outright. For kernel engineers, this patch is a reminder of how subtle memory-ordering assumptions around task/signal lifecycle management can lead to serious use-after-free conditions.